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10.  ABSTRACT  (Continu+d) 

Sciences  Institute  of  the  University  of  Southern  California.  It  was  supported  by  the  TEN  EX 
operating  system,  and  the  user  terminals  were  modified  HP-2649A  CRTs. 

'  >^rhe  MME  system  was  designed  to  give  the  user  the  capability  to  handle  his  message  traffic  (laib 
tncamint  aud^MgMjMEtemwfcaaAfcMawatton  the  system.jThe  system  enforced  multilevel  security 
rules  based  on  a  modification  of  the  security  kernel  model  developed  at  Mitre.  The  rule  enforcement 
was  not  rigorous  enough  for  certification,  but  it  was  sufficiently  rigorous  to  determine  the  effects  on  the 
users’  interactions  with  the  system.  Most  of  the  functions  needed  for  a  user’s  message-related  tasks  were 
provided  by  the  system:  message  filing,  message  replies,  message  commenting  and  “dropping,”  and 
message  release. 


-Alfee  following  conclusions  were  reached  as  a  result  of  the* 

'  iw  •*  vL  a  _ -a.  j  u. _ _ ii _ jii _ <*» . x . .  /  a  tnm\  _ 


Jk  fta.  Automated  Message  Handling  System  (AMHS)  can  be  extremely  useful  in  a  military 
environment,  ixpeftally  during  a  crisis,’  It  must  be  extremely  reliable  and  routinely  available. 

are  noiHdgnmcant  differences  between  message  system  requirements  in  normal  and 
crisis  operation;  'During  a  crisis,  the  system  must  handle  a  higher  volume  of  traffic.  An  AMHS 


'j  will  be  effective  during  a  crisis  only  if  the  personnel  use  it  daily  and  ate,  thus,  thoroughly  familiar  with 
its  operation. 

\c.  ~kn  AMHS  must  provide  services  to  everyone  involved  with  message  handling  Each  user  may 
not  have  a  terminal;  thus,  the  system  must  have  well  thought-out  procedures  for  including  these  indP^ 

viduals  injnocedures  that  have  been  automated  (e4.^iistributk>n).  _  _ - — ^ 

tL^te'AMHSTBBK'BBg  1M  capability  to  produce  hardcopy;  In  the  MME,  many  users  preferred 
piperco£jw  for  reviewing  messages  and  preferred  manual  to  automated  coordination. 

— —  'ILyba  AMHS  should  be  an  integral  part  of  the  user’s  information  handling  systenjT  Users  jgho 
draft  messages  need  to  rate  to  many  documents,  induding  other  messages,  reports,  and  letters.  Many' 
of  these  may  be  stored  on  other  automated  systems,  such  as  word  processors  and  command  and  control 

systems.  A  single  work  station  it  needed  to  support  all  of  these  user  functions.  -  — — ^ 

‘■'ttO/m  acceptable  user  interface  can  Be  devdoped  based  on  the  security  kernel  concept^ 
g,yl  user-oriented  message  system  and  the  telecommunications  center  message  system  with 
which  it  is  associated  must  be  integrated^  Failure  to  integrate  these  functions  will  result  in  reduced 
reliability  and  increased  cost  because  ot\ Incomnatible  Interfaces  and  dunlication  of  functions. 

AMHS  is  a  moreebmpiex  program  than  is  generally  thought,  iynuat  exhibit  the  char¬ 
es  of  a  well-designed  data  base  system,  a  user-oriented  message  processor,  an  interactive  com- 


acteristics  i 

mand  and  control  system,  and  a  rapid  message  handling  system. 
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oweiview 

TW  MXUTAST  MESSAGE  B»m»n 


Th*  Military  bpariamc  wi  a  joint  DAEPA/Mivy/CgCfAff  rap  sr leant 

to  determine  elm  utility  of  u  interact iv«  aaaaafa  service  la  a  military 
command  environment.  The  experiment  mat  conducted  by  developing  •  Masaifra 
ayatem,  installing  it  at  CDfCPAC  with  e  cowasction  to  the  AfffODIM  coasieelce- 
tioo  ayatem,  and  then  using  the  system  for  e  period  of  13  ammths  in  the  daily 
message  handling  teaks  performed  by  the  Operation#  Directorate  (J-3) .  exten¬ 
sive  measurements  were  made  prior  to  and  throughout  the  experiment ;  the 
results  are  documented  in  a  sarins  of  seven  volumes. 


THE  MESSAGE  SYSTEM 

A  message  system  known  as  SIGMA  was  developed  for  the  experiment.  Opera* 
ting  on  a  DEC  PDF- 10  computer,  it  supported  a  total  of  25  display  taxmi&aLs 
and  7  hard  copy  units  1 oca tad  at  selected  uaar  spaces  throughout  the  J-3 
office  araaa.  The  system  provided  access  to  formal  A0TODXH  message  traffic  up 
to  SECRET  classification  level  via  a  connection  to  the  Locel  Digital  Message 
Exchange  (LOME).  Memos  and  informal  notes  capabilities  wars  also  provided. 

The  SIGMA  system  provided  the  user  with  an  extensive  user  interface  that  in¬ 
cluded  capabilities  to  eraata,  adit,  read  and  file  sMesagae .  A  central 
database  of  meesages  permitted  sharing  of  common  messages  by  ell  who  had 
appropriate  aecaaa.  Users  vith  appropriate  aeeasa  could  release  massages 
directly  to  the  ADTODIH  system.  These  and  additional  capabilities  such  as 
forwarding,  assigning  action,  coordinating  draft  message*,  retrieving  massages 
from  Che  archive,  etc.  are  described  in  more  detail  in  volumes  II  and  V  of  th* 
final  report.  Additional  features  were  added  to  SIGMA  throughout  the  course 
of  the  experiment;  this  was  possible  because  of  a  cooperative  working  rela¬ 
tionship  established  between  the  system  developers  end  the  CnvCFAlO  users. 

COMCLUSIOHS 

The  conclusions  which  are  summarised  her*  have  baas  derived  from  data  collected 
by  the  SIGMA  message  system,  interviews  with  users,  and  observations  by  tha 
axpar imantars . 


1.  An  aut 


torn  (AMHg)  is  ueeP 
ttmrdwTivary  oTm 
system;  it  provides  greater  accessibility  to  «ftm  mass  ages  Wt»: 
la  a  shared  database  sad  to  in f onset ioa  diatribe ted  kkwuigi  < 
read board ;  it  improves  effi  oieasy  ia  processing  massagee,  e#j 
the  area  of  aaaaags  retrievals;  it  provides  greater  flaxibili 
tasks  as  searching  on  osar -a  pacified  criteria,  forward  ingai* 
other  ueers,  sad  using  the  system  far  informal  ceansaicacioa 


h  as  electronic 
especially  ia 
41ity  la  aesh 
msesagaS  to. 


ly  if  the  m 


and  crisis  opera  tic-?i.  A  key  require— nt  during  a  crisis  is  to  be  able  to 
filter  incoanng  traffic  under  saturation  conditions  so  that  critical  — s- 
sages  can  be  responded  to  promptly.  An  AMHS  will  be  effective  during  a 
crisis  only  if  the  personnel  who  wist  use  it  are  thoroughly  faailiar  with 
its  operation.  This  implies  that  they  use  it  in  their  daily  — ssage 
handling  tasks. 


The  Telecommunication  System  and  the  User-oriented  Antoma ted  Message 
Handling  Systeu  wist  be  integrated.  In  the  case  of  the  tOB,  these  systems 
were  the  LDMX  and  SIGMA.  Failure  to  properly  integrate  these  functions 
will  result  in  reduced  reliability  through  incompatible  interfaces,  costly 
duplication  of  functions,  and  increased  operating  and  — intenance  coats. 


IMPUCAT10HS  FOR  FUTURE  SYSTEMS 

The  experience  with  the  ms  helped  identify  a  number  of  characteristics  ehich 
future  military  — asage  systeu  should  provide.  The  key  characteristics  are 
briefly  summarised  below. 


Breadth  of  Coverage.  The  AMHS  must  be  available  to  all  segments  of  an 
organisation.  About  60  terminals  would  have  been  needed  to  adequately 
support  J-3  and  about  200  terminals  to  support  all  of  CIHCPAC.  Failure  to 
provide  adequate  coverage  will  necessitate  supporting  a  secondary  system , 
will  reduce  the  responsiveness  of  the  organisation,  will  preclude  the  use 
of  certain  kinds  of  on-line  services  such  as  coordination,  and  will  inhi¬ 
bit  achieving  that  level  of  user  proficiency  necessary  for  effective 
crisis  operation. 

2.  System  Architecture .  The  system  architecture  must  be  able  to  support  a 
large  mnber  of  users  with  reliable,  responsive  service,  and  it  must  be 
able  to  expand  gracefully  to  accommodate  new  requirements.  The  system 
used  in  the  MMB  failed  to  meet  this  requirement  because  of  the  .  lara* 
computational  load  placed  on  the  timesharing  system.  The  recent  emergence 
of  distributed  processing  provided  by  dedicated  workstations  which  erst 
interconnected  by  a  high  bandwidth  local  network  provides  a  basis  on  Shich 
a  future  AMHS  could  be  implemented. 
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of  of  different  classification  level* 

different  security  clearances,  thej 

message  systems .  The  SIGMA  ayet**  seed  in 
for  th*  user  interface  for  a  secure  message 
acceptability  to  the  user  community,  Wseh 

develop  a  provably  secure  multi-level  eyetea.  ■■  '  V 

Functionality,  In  addition  to  tfca  conventional  meesaf*  handling  fii>tj&ei|e. 
of  reviewing,  creating,  editing  and  releaeing  messages,  the  following' 
capabilitie*  proved  extremely  ueeful  and  should  be  included  ia  future  ’ 
systems:  handling  informal  anno  and  notes;  rapid  eeaaaiag  ia  any  order  af 
message  sunaariee  within  a  file;  selective  retrieval  of  aeeenge*  using 
user-specified  criteria;  and  alerting  a  user  when  important  massages 
arrive. 


Design  for  Change,  A  message  system  must  be  designed  so  that  nest 
user-suggested  changes  can  be  easily  incorporated. 
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FINAL  REPORT 
EXECUTIVE  SUMMARY 


1.0  BACKGROUND 
1.1  Introduction 


During  the  late  1960s,  two  American  ships,  the  USS  Liberty  and  the  USS 
Pueblo,  were  involved  in  separate  crises.  Each  crisis  was  exacerbated  by 
unacceptably  long  delays  in  the  delivery  of  critical  military  messages. 

Members  of  Congress  investigated  the  quality  of  U.S.  military  communications 
[1-4]  and  identified  several  causes  for  the  delays.  Further,  they  noted  that 
there  were  numerous,  apparently  uncoordinated,  military  message  centers  under 
development  by  various  elements  of  the  Department  of  Defense.  This  resulted 
in  a  memorandum  from  the  Director,  Telecommunications  and  Command  and  Control, 
OSD,  in  June  1975,  directing  that  techniques  needed  for  secure  interactive 
message  systems  be  developed.  This  directive,  and  parallels  between  message 
processing  systems  being  developed  by  the  Defense  Advanced  Research  Projects 
Agency  (DARPA)  and  emerging  user  requirements  within  military  staffs,  led  to  a 
Memorandum  of  Agreement  (MOA)  [5]  between  DARPA,  the  Naval  Telecommunications 
Command  (NAVTELCOM),  the  Naval  Electronic  Systems  Command  ( NAVELEXSY S COM ) ,  and 
the  Commander  in  Chief  Pacific  (CINCPAC)  for  the  conduct  of  a  military  message 
experiment  (MME) .  This  report  summarizes  the  results  of  the  experiment  as 
viewed  by  these  organizations. 

The  specific  objective  of  the  MME  was  to  determine  the  utility  of  an 
interactive  message  service  in  a  major  military  headquarters.  As  a  part  of 
this  determination,  alternative  features  and  capabilities  were  to  be 
identified;  the  use  of  the  features  was  to  be  observed  and  measured  as  a  means 
of  determining  the  requirements  that  staff  officers  and  action  officers  have 
for  automation  of  message  systems.  These  requirements  are  to  be  used  as  a 
baseline  for  developing  automated  message  handling  systems  for  future  military 
use.  Accordingly,  the  specific  objectives  identified  in  the  MOA  were  to: 

(a)  determine  and  demonstrate  the  usefulness  of  automated  message 
capabilities  and  the  necessary  features  to  support  a  military  message 
handling  system  in  an  operational  environment; 

(b)  determine  the  effect  of  an  automated  message  handling  system  on 
operational  procedures,  manpower,  and  logistics  in  an  operational 
environment; 

(c)  determine  the  training  requirements  associated  with  the  introduction 
of  an  automated  message  handling  system; 

(d)  determine  the  characteristics  of  an  acceptable  user  interface  for  an 
interactive  automated  message  handling  system; 
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' e)  determine  multilevel  security  design  characteristics  and  their  impact 
on  the  user  interface;  and 

(f)  obtain  the  data  necessary  to  assist  in  the  future  design  and 

development  of  a  family  of  automated  message  handling  systems  for  DoD 
use. 

At  the  time  it  was  decided  to  conduct  the  MME,  there  were  two  efforts 
funded  by  DARPA  to  develop  military  versions  of  interactive  message  systems. 
Work  at  Bolt,  Beranek,  and  Newman  (BBN)  of  Cambridge,  HA.,  led  to  the 
development  of  HERMES,  and  work  at  the  Information  Sciences  Institute  of  the 
University  of  Southern  California  (ISI)  led  to  the  development  of  SIGMA.  An 
additional  data-base  oriented  message  system  had  been  developed  by  MIT  under 
DARPA  funding. 

These  organizations  were  chosen  to  modify  their  work  on  automated  message 
systems  so  that  they  could  be  used  by  military  personnel  to  send  and  receive 
messages  via  the  AUTODIN  system.  Preliminary  designs  for  "militarized" 
versions  of  these  three  candidate  message  systems  were  submitted  by  BBN,  MIT, 
and  ISI.  In  order  to  aid  the  developers  in  tailoring  their  systems  to  the 
military  environment,  a  set  of  capabilities  needed  for  a  secure  military 
message  processing  system  was  developed  by  DARPA,  Navy,  and  contract  personnel 
[6,7].  During  the  period  22  February  through  3  March  1977,  representatives 
from  the  Navy,  DARPA,  MITRE  Corp.,  CTEC,  Inc.,  and  the  CINCPAC  staff  evaluated 
the  three  candidate  message  systems. 

The  evaluators  concluded  that  SIGMA,  the  message  service  developed  by 
USC-ISI,  presented  the  user  with  an  interface  and  features  that  would  allow 
the  most  useful  data  to  be  derived  from  the  experiment,  but  noted  that  SIGMA, 
at  that  time,  could  not  adequately  support  the  experiment  and  that  there  was 
"a  considerable  risk  in  upgrading  the  performance  of  SIGMA  to  an  acceptable 
degree."  A  plan  was  developed  to  improve  performance  and  the  features  related 
to  security  and  message  handling  based  on  the  evaluation.  At  the  conclusion 
of  the  evaluation  (documented  in  [8,9])  SIGMA  was  selected  and  subsequently 
installed  as  a  part  of  the  MME  system  at  CINCPAC  in  May  1<>77. 

As  expected,  the  initial  version  of  SIGMA  installed  in  May  1977  did  not 
provide  adequate  response  or  reliability,  and  there  was  a  prolonged  period  of 
shakedown  and  user  training.  Some  upgraded  hardware  and  software  were 
installed,  and  a  period  of  limited  experimental  use  began  in  July  1978.  The 
system  was  continually  improved;  by  October  1978,  the  original  processor  had 
been  replaced  with  a  more  powerful  one  and  a  final  increment  had  increased  the 
main  memory  from  the  original  256K  to  one-million  words.  The  final  impediment 
to  a  reliable  hardware  suite  was  overcome  when  a  marginal  power  filter 
external  to  the  MME  equipment  was  removed  in  early  March  1979.  The  users 
began  full  experimental  use  of  the  system  in  February  1979,  and  the  experiment 
was  concluded  in  September  1979. 

During  the  experiment,  the  users  were  required  to  maintain  the  existing 
paper  system  as  well  as  to  use  the  new  automated  system.  This,  of  course, 
caused  an  increase  in  the  user's  message-handling  workload  above  what  it  would 
have  been  for  the  automated  system  alone,  and  in  some  cases  caused  a  delay  in 
the  users'  acceptance  of  the  automated  system. 
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1.2  Report  Structure 

This  report  summarizes  activity  at  CINCPAC  during  the  experiment, 
identities  conclusions  drawn  on  the  basis  of  that  activity,  and  discusses 
potential  implications  for  future  automated  message  handling  systems.  Two 
previous  reports  cover  earlier  phases  of  the  experiment  in  detail.  The  Quick 
Look  Report  [10]  discusses  the  inception  and  early  operation  of  the  system  and 
provides  a  summary  of  the  SIGMA  message  service  software,  which  served  as  the 
basis  for  user  interaction  with  the  MME  System.  Additional  SIGMA  details  can 
be  found  in  [11-14].  A  second  report,  the  Mid-Experiment  Report  [15]  covers 
operational  activity  during  the  period  November  1978  to  April  1979  and 
provides  a  discussion  of  the  telecommunications  interface  aspects  of  the 
experiment . 

The  Final  Report  of  the  Military  Message  Experiment  is  structured  as  a 
series  of  volumes— published  both  individually  and  jointly  by  participating 
organizations.  The  following  lists  the  volumes  of  the  report. 


Volume 

Number 

Objectives 

Discussed 

Topic 

I 

(a)-(f) 

Executive  Summary 

II 

(a)-(f) 

Pinal  Report  [16] 

III 

(a) ,(b) 
(c),(f) 

CINCPAC 's  User  View  [17] 

IV 

(a),(b) 

Message  System  Utility  [18] 

V 

(a) ,(d) 

(f) 

ISI's  Developer  View  [19] 

VI 

(a) , (b) 

Data  Analysis  [20] 

VII 

(c) 

Training  [21] 

Volumes  I-III  describe  the  basic  experiment  and  its  results.  The 
remaining  volumes  present  supporting  data  and  analyses  for  volumes  I-III. 

1.3  System  Description 

The  basic  elements  of  the  MME  system  as  used  in  the  experismnt  included: 

(a)  Hardware:  a  DEC  PDP-10  computer  with  TENEX  operating  system 
installed  in  a  TOP  SECRET  facility  with  on-line  connection  to  the 
AUTODIN  system  via  the  Local  Digital  Message  Exchange  (LDMX),  a 
terminal  interface  processor  (PDP-11),  25  user  terminals  and  7 
printers  located  in  the  J3  office  areas  of  CINCPAC. 

(b)  Software:  a  message  service  software  system  (SIGMA)  installed  on  the 
PDP-10  and  a  terminal  interface  system  and  LDMX  interface  system 
installed  on  the  PDP-11. 
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(c)  Experiment  Support  Staff:  system  operators,  technicians,  training 
and  management  personnel. 

The  SIGMA  system  allows  users  to  draft  and  edit  messages  on-line 
interactively  using  standard  message  formats.  These  messages  can  then  be 
communicated  informally  within  the  coauand  center  or  formally  coordinated  for 
release  to  AUTODIN  in  electronic  form.  Actual  release  is  performed  by  someone 
with  release  authority.  Incoming  messages  from  AUTODIN  can  be  distributed  and 
read  via  SIGMA.  For  a  complete  description  of  the  features  of  SIGMA,  see  Vol . 
V  (ref  [19])  of  this  series. 

One  of  the  major  goals,  emphasized  strongly  during  the  conception, 
execution,  and  analysis  of  the  experiment,  was  to  determine  the  feasibility  of 
a  secure  message  processing  system.  Because  the  message  system  was  implemented 
on  an  existing  suite  of  hardware  and  software,  there  was  never  an  intent  to 
certify  the  system  for  multilevel  operation;  the  intent  was  to  determine 
whether  or  not  the  use  of  a  particular  security  model  would  be  compatible  with 
the  functions  and  user  interface  of  an  interactive  military  message  processing 
system.  The  security  model  chosen  was  the  "security  kernel." 

The  two  major  requirements  for  a  secure  system  are  to  ensure  that  users 
cannot  gain  access  to  information  for  which  they  are  not  cleared  and  to  ensure 
that  the  security  classification  of  information  in  the  system  cannot  be 
modified  improperly.  The  specific  security  requirements  for  the  experimental 
system  are  detailed  in  [6]  and  [7];  the  results  of  the  evaluation  of  the 
security  design  of  the  three  candidate  message  processing  systems  are 
contained  in  [9].  The  SIGMA  security  system  is  also  discussed  in  more  detail 
in  Vol.  II  (reference  [16])  of  this  series. 


2.0  USE  OF  SIGMA  BY  THE  STAFF 

2.1  CINCPAC  Operations  with  the  MME  System 

This  section  presents  a  brief  overview  of  the  use  of  the  MME  system  at 
CINCPAC;  for  a  more  detailed  description  see  [16],  [19],  and  [20].  During  the 
experiment,  members  of  the  Operations  Directorate  (J3)  at  CINCPAC 
Headquarters,  Camp  Smith,  Hawaii,  used  the  computer  system  for  receiving, 
redistributing,  filing,  and  retrieving  incoming  messages.  The  system  was  also 
used  for  the  generation,  coordination,  and  release  of  outgoing  AUTODIN 
messages  and  the  creation  and  distribution  of  formal  and  informal  notes  and 
memoranda.  Initially,  the  operation  of  SIGMA  mirrored  the  paper  system  in 
detail.  As  the  experiment  progressed,  alternative  patterns  of  use  emerged 
which  were  effective  in  speeding  delivery  of  messages  to  their  destinations. 

2.1.1  Message  Receipt  and  Distribution 

AUTODIN  messages  for  CINCPAC  are  received  from  the  AUTODIN  Service  Center 
at  the  Camp  Smith  LDMX  (Local  Digital  Message  Exchange).  The  LDMX  transmits 
high  precedence  messages  directly  to  the  CINCPAC  Command  Center  in  additional 
to  the  normal  distribution.  During  the  experiment,  messages  that  the  LOME 
determined  should  be  routed  to  the  Operations  Directorate  (J3)  for  ACTION  or 
Information  (INFO)  were  transmitted  electrically  to  the  SIGMA  system.  (Backup 
paper  copies  were  generated  by  the  LDMX  and  picked  up  later  by  J3  personnel.) 
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One*  SIGMA  received  e  meseege,  it  vea  placed  in  the  SIGMA  aeaaage  file  and 
protected  froa  changes.  A  summary  of  the  message  was  placed  in  the 
Administrative  Branch's  (J301)  pending  file  (SIGMA's  version  of  an  "electronic 
in-box")  and  in  the  datefile  (a  file  of  messages  with  a  comon  date  of  origin). 

Using  SIGMA,  J301  usually  began  the  day  by  displaying  the  pending  file  and 
moving  J3  INFO  messages  to  a  file  called  the  "Today"  file.  Foreign  Broadcast 
Information  Service  (FBIS)  messages  were  deleted.  When  the  pending  file  had 
been  cleared  of  these  messages,  the  distribution  task  began.  To  distribute 
messages,  the  J301  user  executed  a  sequence  of  three  instructions.  The  first 
selected  a  set  of  messages  of  interest  to  a  particular  division  (based  on 
criteria  specified  by  a  "selector"  it  had  specified).  The  second  routed  the 
messages  for  ACTION  to  that  division,  forwarded  copies  for  information  to 
other  divisions,  filed  a  J301  copy,  if  desired,  and  deleted  the  set  of 
messages  from  J301's  pending  file.  The  third  instruction  displayed  to  the 
user  the  remaining  set  of  messages  that  had  not  yet  been  processed.  This 
sequence  of  instructions  was  repeated  until  all  predefined  selectors  had  been 
used.  The  remaining  message  suonaries  were  scanned,  with  the  user  often  making 
routing  decisions  on  the  basis  of  the  summary  itself.  About  13%  of  all  the 
messages  were  actually  read  by  J301,  presumably  to  help  in  routing  decisions. 
The  message  distribution  function  could  have  been  automated  easily  with  J301 
distributing  only  those  messages  that  were  not  handled  by  the  pre-defined 
selectors. 

After  a  message  (actually  a  summary)  was  delivered  to  a  user's  pending 
file,  it  was  his  responsibility  to  take  the  proper  action.  If  the  user  was 
logged  in  at  the  tisw,  the  information  that  a  message  had  arrived  was  placed 
at  the  top  of  his  screen.  Most  users  did  not  maintain  a  constant  vigil  at  the 
terminal,  but  periodically  processed  their  pending  files.  The  action  officers 
maintained  and  used  SIGMA  amssage  files;  they  spent  an  average  of  6-30  minutes 
a  day  using  message  files.  This  was  significantly  less  than  the  time 
previously  spent  carrying  out  similar  functions  with  hard  copy  files. 

Many  action  officers  did  not  wait  for  J301  to  route  the  messages,  but 
accessed  the  datefile  directly  and  selected  those  messages  that  were  of 
possible  interest.  Thus,  they  were  able  to  use  more  flexible  selection 
criteria  than  the  profile  being  used  by  J301,  and  they  were  able  to  get  the 
messages  earlier.  Toward  the  and  of  the  experiment,  it  was  clear  that  J301's 
manual  routing  function  was  becoming  less  important  and  that  future  systems 
could  rely  on  automated  routing  systems  that  could  be  changed  easily  by  the 
users. 

Because  the  system  in  use  prior  to  SIGMA  was  maintained  as  a  backup  for 
the  Command  Center  Watch  Team  (CCWT)  and  because  high-precedence  messages  were 
transmitted  directly  from  the  LDMX  to  the  printer  in  the  Cnmmsnd  Center,  the 
changes  in  message  distribution  were  not  as  dramatic  for  the  Command  Center 
Watch  Team  as  for  the  action  officers.  The  CCWT  used  SIGMA  to  build  and 
access  files  and  to  build  the  readboard  for  J3;  except  for  the  direct  delivery 
of  high -precedence  traffic,  the  us*  of  the  system  by  the  CCWT  was  about  the 
same  as  that  by  action  officers. 


2.1.2  Message  Creation,  Coordination  and  Release 

CINCPAC  J3  is  typical  in  that  the  directorate  receives  aore  aessages  than 
it  transmits.  But  the  number  of  man-hours  per  message  to  create,  coordinate, 
and  release  an  outgoing  message  is  considerably  higher  than  the  nuaber  of 
man-hours  per  message  to  process  incoming  aessages.  A  two— dimensional  screen 
editor  was  used  to  create  aessages  and  edit  them  on  a  display  terminal. 

Anyone  with  authorized  access  to  a  terminal  could  create  messages,  display 
them,  produce  hardcopy  printouts  on  any  of  several  printers  or  send  thea 
electronically  to  other  users  of  the  SIGMA  systea.  The  coordination  of  any 
given  message  was  required  prior  to  its  release  via  AOTODIN .  Actual  release 
of  coordinated  aessages  was  straightforward,  but  was  permitted  only  by 
authorized  users.  The  SIGMA  system  enforced  this  requirement.  The  design  and 
implementation  of  a  satisfactory  systea  for  coordinating  outgoing  aessages 
were  difficult,  but  towards  the  end  of  the  experiment,  the  on  site  teaa  and 
the  CINCPAC  users  had  devised  a  system  that  was  beginning  to  be  used  by  the 
users.  The  major  coordination  problems  were: 

(a)  usually,  not  all  persons  needed  for  coordination  of  an  outgoing 
message  were  systea  users, 

(b)  all  coordinators  might  not  be  logged  on, 

(c)  some  background  material  needed  for  coordination  was  not  on  the 
automated  system,  and 

(d)  some  users  believed  the  social  intercourse  of  face-to-face 
coordination  was  needed. 

2.1.3  Other  Uses  of  SIGMA 

SIGMA  was  used  to  file  incoming  messages  on-line  for  a  period  of  30  days, 
after  which  the  messages  were  automatically  archived  to  magnetic  tape  if 
unused  for  that  period.  Message  retrieval  was  easily  accomplished  since  the 
system  maintained  a  list  of  message  citations  (summaries)  on-line  for  the 
entire  experiment.  From  the  list  of  citations,  a  user  could  select  one  or 
more  messages  for  display  or  printout.  On-line  aessages  would  be  displayed 
immediately  while  archived  aessages,  if  selected,  were  automatically  retrieved 
and  available  for  display,  typically  within  fifteen  minutes. 

Messages  received  at  CINCPAC  which  were  to  be  redistributed  to 
organizations  outside  CINCPAC  required  readdressal.  In  the  manual  system, 
this  was  a  cumbersome  process  requiring  much  time  and  paperwork.  This  was 
accomplished  easily  in  the  SIGMA  systea  using  a  single  function  key  to 
initiate  the  readdressal.  The  necessary  additional  information  was  provided 
by  using  a  form  generated  by  SIGMA  on  the  display. 

Headboards  in  the  manual  system  ware  a  collection  of  key  aessages 
(outgoing  and  incoming)  and  action  items  prepared  daily  for  the  J3.  An 
electronic  version  of  the  readboard  was  prepared  by  the  command  center 
personnel  using  SIGMA  to  aake  this  information  available  to  the  J3  staff  as 
well  as  the  J3.  This  kept  the  staff  aware  of  current  items  brought  to  the 
J3's  attention  and  disseminated  the  readboard  information  to  many  s»re  people 
than  before. 
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SIGMA  provided  a  capability  Co  craata  informal  notaa  and  formal  memos  for 
intra-directorate  communications.  They  mere  used  extensively  toward  the  and 
of  the  experiment.  The  principal  users  were  action  officers  and  members  of 
the  CCVT.  SIGMA  was  also  used  as  an  office  word  processing  system  to  generate 
material  for  use  in  briefings,  draft  letters,  notes  on  projects,  status  of 
action,  and  day-logs  to  aid  in  watch-shift  transitions. 

2.2  Benefits  of  the  Automated  System 

To  aid  in  determining  the  functions  needed  in  future  amssage  handling 
systems,  auditing  programs  in  SIGMA  recorded  the  use  of  the  system  functions; 
these  data  were  then  analysed  to  determine  the  most-frequent ly  used 
instructions,  type  of  use  by  various  offices,  the  pattern  of  use  in  exercises 
and  normal  periods,  etc.  This  information  is  reported  fully  in  [16],  and  a 
detailed  analysis  of  the  data  is  contained  in  [20].  The  following  is  a 
synopsis  of  the  inferences  based  on  the  collected  statistics.  This 
information,  along  with  observations,  analyses  of  uat?  interviews,  etc.,  was 
used  to  form  the  conclusions  reported  in  section  1  :  this  report. 

Use  of  Sigma  reduced  the  distribution  efto*t  *«n-hours)  by  511  and  the 
average  age  of  a  message  delivered  to  an  acti/a  >? * by  752.  The 
most-important  features  to  the  distribution  ft&&  iM.  were: 

(a)  pre-defined  selectors, 

(b)  the  route  command,  and 

(c)  the  ability  to  deal  with  citations  vice  complete  messages. 

The  most-important  features  related  to  the  use  of  the  system  for  filing, 
retrieving,  and  using  the  informational  content  of  the  isessages  were: 

(d)  access  to  more  information, 

(e)  selective  retrieval, 

(f)  easy  access  to  archived  messages,  and 

(g)  access  to  the  daily  readboard  prepared  for  the  J3  brief. 

The  most-important  features  related  to  the  use  of  the  system  for 
originating  and  transmitting  messages  were: 

(h)  the  word-processing  capabilities  used  for  editing, 

(i)  the  copy-text  feature  that  provided  more  complete  and  more  accurate 
text  because  no  errors  were  introduced  by  retypings, 

(j)  the  readdressal  feature, 


(k)  the  ability  to  generate  formal  and  informal  notes  and 


randa,  and 


(1)  the  on-line  coordination  capability  (see  [16],  [17],  [19],  and  [20], 
however,  for  the  probleas  associated  with  developing  and  using  the 
coordination  capability). 


3.0  CONCLUSIONS 

3.1  Introduction 

The  following  conclusions  are  derived  froa  the  analysis  of  experiaental 
data  collected,  interviews  with  users,  and  observations  by  the  evaluators. 

3.2  Conclusions  froa  the  Experiment 

(a)  An  autoaated  aessage  system  can  be  extreaely  useful  in  a  ailitary 
environment  during  both  normal  and  crisis  operations  (1)  by  reducing 
message  distribution  tiaes,  (2)  by  providing  more  accurate  and 
efficient  distribution  and  retrieval  through  user-specified  criteria, 
and  (3)  by  providing  word-processing  capabilities  for  generating 
messages  and  other  documents,  thus  reducing  errors  in  preparation  and 
release. 

For  these  advantages  to  be  achieved,  the  system  must  be  extremely 
reliable  and  routinely  available.  Because  SIGMA  was  used 
interactively,  the  users  desumded  more  reliability  and  availability 
of  it  than  they  did  of  the  LDMX. 

(b)  There  are  no  significant  differences  between  system  requirements  in 
normal  and  crisis  operation.  During  a  crisis,  the  voluae  of  traffic 
will  usually  increase;  thus,  incoming  traffic  must  be  filtered  so 
that  critical  aessages  can  be  identified  and  responded  to  promptly. 

An  Autoaated  Message  Handling  System  (AMHS)  will  be  effective  during 
a  crisis  only  if  the  personnel  who  must  use  it  are  thoroughly 
faailiar  with  its  operation.  The  system  should  be  in  daily  use  and 
sized  to  handle  worst-case  expected  traffic  loads. 

(c)  An  autoaated  aessage  systea  must  provide  services  to  everyone 
involved  with  aessage  handling.  Failure  to  provide  adequate  coverage 
will  reduce  the  effectiveness  of  the  organization  and  will  inhibit 
achieving  the  level  of  user  proficiency  needed  for  effective  use  of 
the  systea  during  a  crisis.  Further,  each  user  aay  not  have  a 
terminal;  therefore,  the  system  must  have  a  well  thought-out 
procedure  for  including  these  individuals  in  processes  that  have  been 
autoaated  (e.g.,  distribution).  The  design  of  the  systea  should 
consider  both  users  who  will  usually  interface  with  the  system  using 
paper  copies  and  clerk/typists. 

(d)  An  automated  aessage  systea  aust  have  the  capability  to  produce  hard 
copy.  In  the  MME,  many  users  preferred  paper  copies  for  reviewing 
messages  and  preferred  not  to  use  the  autoaated  coordination  because 
it  did  not  provide  the  face-to-face  contact  that  soae  felt  was 
important . 


(e)  An  automated  message  system  should  be  an  integral  part  of  the  user's 
information  handling  system.  Users  who  draft  messages  need  to  refer 
to  many  documents,  including  other  messages,  reports,  and  letters  — 
many  of  which  may  be  stored  on  other  automated  systems.  A  single 
workstation  is  needed  to  support  the  user's  message-handling, 
command -and -control,  and  word-processing  functions. 

(f)  An  acceptable  user  interface  can  be  developed  based  on  the  security 
kernel  concept.  While  the  MME  experiment  did  not  explicitly  test  a 
security  kernel,  the  user  interface  was  designed  and  implemented  to 
operate  with  such  a  kernel.  The  restrictions  on  the  user  imposed  by 
the  security  controls  were  acceptable  and  did  not  detract  from  the 
usefulness  and  convenience  of  the  message  system. 

(g)  A  user-oriented  message  system  and  the  telecommunications  center 
message  system  with  which  it  is  associated  must  be  fully  integrated. 
Failure  to  integrate  these  functions  will  result  in  reduced  reli¬ 
ability  and  increased  cost  because  of  incompatible  interfaces  and 
duplication  of  functions. 

(h)  An  autosuted  military  message  system  is  a  more  complex  program  than 
is  generally  thought.  It  must  exhibit  the  characteristics  of  a 
well-designed  data  base  system,  a  user-oriented  word  processor,  an 
interactive  command  and  control  system,  and  a  rapid  message  handling 
system. 

3.3  Implications  for  Future  Systems 

(a)  Breadth  of  Coverage.  A  system  oust  have  an  adequate  number  of 
terminals  and  printers  to  be  accessible  throughout  the  organization 
it  serves.  It  must  also  have  the  functionality  and  sufficient 
processing  power  to  support  a  critical  mass  of  users.  It  should  be 
used  on  a  regular  basis  (e.g.  daily)  to  insure  adequate  familiarity 
on  the  part  of  the  user. 

(b)  Capacity.  An  AMHS  should  be  sized  to  handle  worst-case  expected 
traffic  loads. 

(c)  Reliability.  The  system  reliability  and  availability  must  approach 
100Z.  Further,  it  must  be  perceived  by  the  users  as  reliable  and 
available.  The  user  must  be  able  to  depend  upon  the  system  in  time 
of  need. 

(d)  Architecture.  The  system  must  be  able  to  expand  gracefully  to 
accommodate  additional  users  or  new  functions.  Alternative 
architectures  based  on  the  use  of  distributed  processing  appear  to  be 
more  appropriate  choices  than  a  centralized  time  sharing  system. 

(e)  Useful  Functions.  The  following  are  useful  in  a  military  message 
processing  system:  handling  of  informal  memos  and  notes;  repid 
scanning  in  any  order  of  message  summaries  within  a  file;  selective 
retrieval  of  messages  using  user-specified  criteria;  alerting  a  user 
when  sn  important  message  arrives.  In  addition,  a  terminal  with 
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multiple  windows  allows  viewing  related  material  while  coaq>osing  a 
message  or  performing  other  similar  tasks. 

(f)  Design  for  Change.  The  system  must  be  designed  so  that  swat 
user-suggested  changes  can  be  easily  incorporated. 

(g)  Security.  Future  message  systems  must  be  able  to  support  messages 
with  different  classification  levels  and  users  with  different 
clearances.  Further  research  in  this  area  is  warranted. 

3.4  Concluding  Besurks 

(a)  The  handling  of  formal  military  messages  will  continue  to  be  a 
combination  of  paper  handling  and  interactive  message  handling.  In 
future  years,  the  amount  of  interactive  message  handling  in  the  DoD 
will  increase.  However,  because  some  message  processing  tasks  cannot 
be  automated  easily  and  because  of  organizational  preferences, 
certain  manual  procedures  will  probably  be  retained. 

(b)  The  limitations  of  current  large  centralized  message  processing 
systems  coupled  with  decreasing  hardware  costs  will  encourage  the 
development  of  distributed  message  system  architectures.  In  soam 
cases,  each  user's  terminal  may  be  powerful  enough  to  act  as  his  own 
dedicated  message  processor.  These  processors  will  be  connected 
together  via  local  networks. 

(c)  Although  the  MME  system  could  only  handle  text  messages,  future 
sy steam  should  support  new  types  of  messages,  such  as  facsimile, 
voice,  and  graphics.  Human  factors  issues,  workstation  design,  and 
protocols  for  supporting  these  new  messages  should  be  explored  or 
developed.  In  addition,  new  functional  capabilities  such  as 
automated  distribution  of  messages  should  be  included. 

(d)  Although  there  are  numerous  examples  in  which  privacy  controls  would 
be  useful,  a  comprehensive  design  of  privacy  controls  for  military 
message  systeau  does  not  exist;  such  a  design  should  be  formulated 
and  tested. 
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